cloudtaser-cli source rebootstrap port¶
Managed Port Pod replacement loses its tmpfs SecretID. Use --authority-instance, --values (the existing public Port chart values), --pod and --pod-uid with --confirm-rebootstrap to hand off one fresh response-wrapped SecretID to a verified waiting replacement Pod. The pinned signed cohort, source authority, immutable public configuration, CA and admission denial are checked first. An ambiguous handoff requires a new Pod; no keeper or automatic retry is started. Unpublished cohort pins fail closed. Legacy bootstrap surfaces retain their gates.
Usage¶
Examples¶
cloudtaser-cli source rebootstrap port --authority-instance <instance> --values <public-port-values.yaml> --pod <replacement> --pod-uid <uid> --confirm-rebootstrap ...
Flags¶
| Flag | Type | Default | Required | Description |
|---|---|---|---|---|
--authority-instance |
string | (empty) |
no | active administrator-approved source authority instance (managed enrollment) |
--beacon-address |
string | (empty) |
no | beacon relay address (host:port). Overrides the address inside --beacon-token when both are set. |
--beacon-spki-fingerprint |
string | (empty) |
no | lowercase SHA-256 Beacon TLS SPKI pin for managed enrollment |
--beacon-token |
string | (empty) |
no | opaque ctb1 beacon token from 'cloudtaser-cli beacon install' (bearer credential; prefer --beacon-token-file) |
--beacon-token-file |
string | (empty) |
no | path to a file containing the ctb1 beacon token, or '-' for stdin |
--confirm-rebootstrap |
bool | false |
no | confirm creation of one new Port bootstrap credential generation |
--dry-run |
bool | false |
no | render installer (Linux) or YAML (Kubernetes), do not deploy |
--executable |
string | /usr/local/libexec/cloudtaser-port |
no | absolute Port binary path for the Linux host install script |
--force |
bool | false |
no | allow unsafe init secret printing when stderr is not a TTY |
--help, -h |
bool | false |
no | help for port |
--init-out |
string | ./cloudtaser-init.json |
no | path for OpenBao init output JSON (0600; used for initialization and interrupted-install recovery; pass explicitly for external endpoints) |
--kubeconfig |
string | (empty) |
no | path to kubeconfig file |
--kv-mount |
string | secret |
no | KV v2 engine mount path |
--namespace, -n |
string | openbao |
no | K8s namespace for the CloudTaser Port deployment |
--pod |
string | (empty) |
no | fresh waiting replacement Pod name |
--pod-uid |
string | (empty) |
no | exact replacement Pod UID; never inferred or retried |
--port-chart |
string | (empty) |
no | override the Port Helm chart with an OCI reference (oci://...) or local path (development/self-hosted scenarios only) |
--port-chart-version |
string | (empty) |
no | chart version for a local --port-chart path (development/self-hosted scenarios only) |
--port-credentials-in |
string | (empty) |
no | absolute path to an exact cloudtaser.port-approle-bootstrap/v1 handoff (imports once; raw fields are never printed) |
--port-pki-approval |
string | (empty) |
no | public approval used by source prepare port-introduction-pki |
--port-pki-journal |
string | (empty) |
no | ready public source PKI preparation journal (read-only) |
--port-version |
string | (empty) |
no | exact managed cohort Port version for --type=linux; another version is refused |
--secretstore-address |
string | (empty) |
no | secret store address (auto-discovered if empty; env: CLOUDTASER_SECRETSTORE_ADDRESS, VAULT_ADDR) |
--secretstore-auth-path |
string | kubernetes |
no | Kubernetes auth method mount path |
--secretstore-ca-file |
string | (empty) |
no | path to a PEM CA certificate used to verify the secret store TLS endpoint |
--secretstore-k8s-namespace |
string | openbao |
no | K8s namespace of the secret store (for auto-discovery) |
--secretstore-token |
string | (empty) |
no | secret store token (prefer --secretstore-token-file or SECRETSTORE_TOKEN to avoid process-list exposure) |
--secretstore-token-file |
string | (empty) |
no | path to a file containing the secret store token, or '-' to read it from stdin |
--shamir-shares |
int | 5 |
no | Shamir key shares (only used if the secret store is fresh) |
--shamir-threshold |
int | 3 |
no | Shamir unseal threshold (only used if the secret store is fresh) |
--show-init-secrets |
bool | false |
no | print raw OpenBao root token and unseal keys to stderr (unsafe; TTY only unless --force) |
--type |
string | kubernetes |
no | Port deployment type: linux (signed binary install script) or kubernetes (verified chart) |
--values |
string | (empty) |
no | existing public Port chart values including bootstrap ID, introduction and site settings |
--vault-release |
string | openbao |
no | OpenBao Helm release name (for auto-discovery; legacy flag name) |
--yes, -y |
bool | false |
no | assume yes for interactive prompts |